CVE-2026-105628: Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint
Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatarurl from provider user data through a server-side HTTP request without internal IP validation and follows redirects by default. An attacker can provide an avatar URL that redirects to an internal-only resource, such as a metadata endpoint, and Plane uploads the fetched response as a user avatar file. The object is then exposed through /api/assets/v2/static/{assetid}/, allowing exfiltration of internally fetched content. This issue is fixed in 1.4.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
planeto a version that resolves this vulnerability.Fixed in 1.4.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs high privileges and must be able to control an OAuth provider avatar_url returned in provider user data. The vulnerable flow then causes the Plane server to retrieve that URL.
What conditions make the SSRF lead to data exposure?
The supplied avatar URL must redirect to an internal-only resource. Plane follows redirects, stores the fetched response as an avatar file, and exposes that object through the static asset endpoint.
Are default deployments affected?
The provided data identifies the OAuth avatar synchronization flow as affected, but does not state whether it is enabled or reachable in a default deployment.
What versions should be remediated?
Plane versions prior to 1.4.0 are affected. Upgrade to version 1.4.0 or later.
How can defenders identify possible exploitation?
Review avatar assets served from /api/assets/v2/static/{asset_id}/ for content that does not resemble an expected image. The issue can result in internally fetched resource content being uploaded and exposed as a user avatar file.